Check out the PanelFi demo — sign in to both panels, nothing to install
PanelFivs cPanel
Documentation · Server panel: DNS

DNSSEC

DNSSEC signs a zone so resolvers can prove its answers were not forged. Signing has two halves: turn it on in PanelFi, then give the DS record to the domain's registrar.

Where to find itServer panel › DNS Functions › DNSSEC

Sign a zone

  1. Open DNS Functions > DNSSEC. The table lists each zone, its account and whether it is Signed or Not signed.
  2. Click Sign zone beside the zone.
  3. Click DS records for the zone. The dialog shows the key tag, algorithm (ECDSA P-256 with SHA-256), digest type and digest. Most registrars ask for the SHA-256 one. For registrars that want the key instead of a digest, the dialog also shows the public key (DNSKEY).
  4. Enter the DS record at the domain's registrar.
PanelFi DNSSEC page
DNSSEC: sign zones and read their DS records.

Until the registrar publishes the DS record, the zone works exactly as before.

Remove signing

Click Remove keys on a signed zone.

Remove the DS record at the registrar first. After the registrar has published the DS record, removing the keys here without removing the DS record there makes the domain unreachable for validating resolvers.

Notes

  • If the page says the DNS software cannot sign zones, DNSSEC is not available on that server.
  • With DNS clustering, signed zones are copied to secondaries with their signatures.